CVE-2019-6714

CRITICAL

Blogengine.net < 3.3.6.0 - Path Traversal

Title source: rule

Description

An issue was discovered in BlogEngine.NET through 3.3.6.0. A path traversal and Local File Inclusion vulnerability in PostList.ascx.cs can cause unauthenticated users to load a PostView.ascx component from a potentially untrusted location on the local filesystem. This is especially dangerous if an authenticated user uploads a PostView.ascx file using the file manager utility, which is currently allowed. This results in remote code execution for an authenticated user.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Dustin Cobb · webappsaspx

https://www.exploit-db.com/exploits/46353

View Code ZIP pw:eip

References (5)

[Exploit, Third Party Advisory, VDB Entry] http://packetstormsecurity.com/files/151628/BlogEngine.NET-3.3.6-Directory-Traversal-Remote-Code-Execution.html

[Mailing List] http://seclists.org/fulldisclosure/2019/Jun/26

[Product] https://blogengine.io/

[Product, Third Party Advisory] https://github.com/rxtur/BlogEngine.NET/

[Exploit, Third Party Advisory, VDB Entry] https://www.exploit-db.com/exploits/46353/

Scores

CVSS v3 9.8

EPSS 0.1696

EPSS Percentile 95.0%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-22

Status published

Products (1)

blogengine/blogengine.net < 3.3.6.0

Published Mar 21, 2019

Tracked Since Feb 18, 2026